#!/usr/bin/env python
# Copyright (c) 2014, The MITRE Corporation. All rights reserved.
# See LICENSE.txt for complete terms.

from stix.core import STIXPackage
from stix.indicator import Indicator
from stix.ttp import TTP
from cybox.core import Observable
from cybox.objects.address_object import Address
from cybox.objects.uri_object import URI
from cybox.objects.file_object import File
from cybox.common import Hash
from stix.common import Confidence
from stix.common.vocabs import VocabString

def main():
    stix_package = STIXPackage()
    ttp = TTP(title="C2 Behavior")
    
    # IP Watchlist
    indicator = Indicator(title="IP Address for known C2 Channel")
    indicator.add_indicator_type("IP Watchlist")

    addr = Address(address_value="10.0.0.0", category=Address.CAT_IPV4)
    addr.condition = "Equals"
    indicator.add_observable(addr)
    indicator.add_indicated_ttp(TTP(idref=ttp.id_))

    stix_package.add_indicator(indicator)
    
    
    # URL Watchlist
    indicator = Indicator()
    indicator.id_ = "example:package-382ded87-52c9-4644-bab0-ad3168cbad50"
    indicator.title = "Malicious site hosting downloader"
    indicator.add_indicator_type("URL Watchlist")
    
    for i in ['http://baidu.com','http://x4z9arb.cn/4712']:
        url = URI()
        url.value = i
        url.type_ =  URI.TYPE_URL
        url.value.condition = "Equals"
        indicator.add_observable(url)
    
    stix_package.add_indicator(indicator)
    
    
    
    # file Watchlist
    file_hash = 'c0d37337fbc78fdf411f8e32ad8212e0a04dca72'
    indicator = Indicator(title="File Reputation for SHA1=c0d37337fbc78fdf411f8e32ad8212e0a04dca72")
    indicator.add_indicator_type("File Hash Watchlist")

    file_object = File()
    file_object.add_hash(Hash(file_hash))
    file_object.hashes[0].simple_hash_value.condition = "Equals"
    file_object.hashes[0].type_.condition = "Equals"
    indicator.add_observable(file_object)

    indicator.add_indicated_ttp(TTP(title="Malicious file"))

    indicator.confidence = Confidence(value=VocabString('75'))
    indicator.confidence.value.vocab_name = "Percentage"
    indicator.confidence.value.vocab_reference = "https://en.wikipedia.org/wiki/Percentage"

    stix_package.add_indicator(indicator)
    
    
    # Domain Watchlist
    indicator = Indicator()
    indicator.id_ = "example:package-382ded87-52c9-4644-bab0-ad3168cbad50"
    indicator.title = "Malicious site hosting downloader"
    indicator.add_indicator_type("Domain Watchlist")
    for i in ['baidu.com','x4z9arb.cn/4712']:
        url = URI()
        url.value = i
        url.type_ =  URI.TYPE_DOMAIN
        url.value.condition = "Equals"
        indicator.add_observable(url)
    stix_package.add_indicator(indicator)
    
    stix_package.add_ttp(ttp)
    print stix_package.to_xml()

if __name__ == '__main__':
    main()
